CN102480729B - Method for preventing fake user in wireless access network and access point - Google Patents

Abstract

The invention discloses a method for preventing a fake user in a wireless access network and an access point. The method comprises the following steps: establishing one or more virtual access points, wherein a virtual access point has a Basic Service Set Identification (BSSID) corresponding thereto; connecting the terminal to a virtual access point according to the MAC address of the terminal, and authenticating the terminal; for the legal terminal passing the authentication, binding the IP address and/or the MAC address of the legal terminal with BSSID of a virtual access point connected with the legal terminal, and determining the binding relationship between the legal terminal and the virtual access point; and forwarding the data frame sent by the legal terminal according to the binding relationship, and discarding the data frame sent by the fake terminal. By means of the technical scheme of the invention, the aim of preventing fake users in the 802.11 wireless access network can be realized.

Description

Method and access point for preventing counterfeit users in wireless access network

technical field

The invention relates to the field of mobile communication, in particular to a method and an access point for preventing counterfeit users in a wireless access network.

Background technique

Currently, in an 802.11 wireless access network built by a network operator, a commonly used authentication method is web (Web) authentication. This method requires an access point (AP for short) to be advertised as an open system, and the user terminal can connect to the AP without entering a password, and can dynamically obtain an IP address. However, at this time, the user terminal is restricted from accessing the network, and can only access a few limited addresses, for example, a domain name system (domain name system, DNS for short) server, a web portal (WebPortal) server, and the like. When the user opens the browser and visits any page, it will be redirected to the WebPortal server, and the WebPortal server will push a web login page to the user, prompting the user to enter the user name and password. If the user has opened the corresponding service in the business hall in advance, he can directly input the user name and password applied for when opening the service. If not, you can enter your mobile phone number and receive a temporary username and password through your mobile phone. After the user passes the authentication, various services can be used normally.

The advantage of adopting the web authentication method is that there is no need to download and install customized client software on the user terminal, and the login process can be completed by using a browser. The disadvantage is that the over-the-air messages exchanged between the user terminal and the AP are usually not encrypted, and there are potential security risks. One of the more serious ones is spoofing users. Fake users use the air packet capture tool to capture air packets exchanged between other user terminals and APs, and obtain information such as MAC addresses and IP addresses of authenticated legitimate terminals. Then change the MAC address and IP address of your wireless network card to those of a legal terminal. In this way, the packets sent by the counterfeit terminal are actually the same as those sent by the legitimate terminal, and the AP cannot distinguish them. The counterfeit terminal can use services that can only be used by legitimate terminals without being authenticated. The fees generated by counterfeit users will be calculated into the accounts of legitimate users, which will damage the interests of legitimate users and operators.

In related technologies, other commonly used authentication methods in wireless access networks include pre-shared key and 802.1x authentication. Most wireless access networks using these two authentication methods will encrypt the messages transmitted over the air. If they are not encrypted, there will also be problems of impersonating users.

At present, in a wired access network, preventing counterfeit users usually adopts a method of binding a physical port with an Internet Protocol (Internet Protocol, referred to as IP) address + a Media Access Control (Medium/Media Access Control, referred to as MAC) address. That is, after the user passes the authentication, the switch binds the terminal's IP address + MAC address (or only the IP or MAC address) to the physical port it is connected to. If a message with the same IP address or MAC address comes in from other physical ports, will be considered illegal and will be discarded. However, there is a prerequisite for realizing the above method: the legal terminal and the counterfeit terminal are connected to different physical ports. Even if the source MAC address and IP address of the message are the same, it can be determined which terminal sent the message through the incoming physical port.

In the wireless access network, there is a difference between the AP and the switch in the wired access network. The wireless channel where the AP works can be regarded as a physical port. Generally, an AP can only work on one or two wireless channels at any time (some APs support 802.11a/b/g, and can work on 2.4G and 5G at the same time. channel), so the AP only has 1 or 2 physical ports. Both the legitimate terminal and the counterfeit terminal are connected to the AP through the same physical port, so the method of IP+MAC binding to the physical port is not applicable in the wireless access network. Therefore, there is an urgent need for a method for preventing counterfeit users that can be applied to wireless access networks.

Contents of the invention

The invention provides a method and an access point for preventing counterfeit users in a wireless access network to solve the problem in the prior art that counterfeit users cannot be prevented under the condition that the messages transmitted in the air in the wireless access network are not encrypted.

The invention provides a method for preventing counterfeit users in a wireless access network, including:

Establish one or more virtual access points, wherein the virtual access points have a corresponding basic service set identifier BSSID;

Connect the terminal to a virtual access point according to the terminal's MAC address, and authenticate the terminal;

For a legal terminal that has passed the authentication, bind the IP address and/or MAC address of the legal terminal with the BSSID of the virtual access point connected to the legal terminal, and determine the binding relationship between the legal terminal and the virtual access point;

According to the binding relationship, the data frames sent by the legal terminal are forwarded, and the data frames sent by the fake terminal are discarded.

The present invention also provides an access point, including:

A first establishing module, configured to establish one or more virtual access points, wherein the virtual access points have a corresponding basic service set identifier BSSID;

A connection module, configured to connect the terminal to a virtual access point according to the MAC address of the terminal;

An authentication module, configured to authenticate the terminal;

The second establishment module is used to bind the IP address and/or MAC address of the legal terminal to the BSSID of the virtual access point connected to the legal terminal for the legal terminal that has passed the authentication, and determine the binding between the legal terminal and the virtual access point determine the relationship;

The processing module is configured to forward the data frames sent by the legitimate terminal according to the binding relationship, and discard the data frames sent by the counterfeit terminal.

The beneficial effects of the present invention are as follows:

By establishing a VAP and binding the IP+MAC of the legal terminal to the VAP, it solves the problem that the existing technology cannot prevent counterfeit users when the packets transmitted in the air in the wireless access network are not encrypted. The purpose of preventing counterfeit users during network access protects the interests of legitimate users and operators.

Description of drawings

FIG. 1 is a flowchart of a method for preventing counterfeit users in a wireless access network according to an embodiment of the present invention;

Fig. 2 is the schematic diagram that the AP of the embodiment of the present invention prevents counterfeit user processing;

Fig. 3 is the signaling flowchart of calling the hook function according to the embodiment of the present invention;

Fig. 4 is the flowchart of calling connection establishment hook function according to the embodiment of the present invention;

Fig. 5 is a flow chart of calling a connection disconnection hook function according to an embodiment of the present invention;

Fig. 6 is the flowchart of calling the authentication end hook function according to the embodiment of the present invention;

Fig. 7 is the flowchart of calling forwarding hook function according to the embodiment of the present invention;

Fig. 8 is a schematic structural diagram of an access point according to an embodiment of the present invention.

Detailed ways

As mentioned above, the method of IP+MAC binding physical port is often used in the wired access network to prevent counterfeit users, but this method is not applicable in the wireless access network. In order to solve the problem that the existing technology cannot prevent counterfeit users in the case of unencrypted messages transmitted over the air in the wireless access network, the present invention provides a method and an access point for preventing counterfeit users in the wireless access network, Aiming at the characteristics of 802.11 wireless access network, a method of IP+MAC binding VAP is proposed, which realizes the purpose of preventing fake users in 802.11 wireless access network. The present invention will be described in further detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention.

method embodiment

According to an embodiment of the present invention, a method for preventing counterfeit users in a wireless access network is provided. FIG. 1 is a flowchart of a method for preventing counterfeit users in a wireless access network according to an embodiment of the present invention. As shown in FIG. 1 , The method for preventing counterfeit users in the wireless access network according to the embodiment of the present invention includes the following processing:

Step 101, establishing one or more virtual access points, wherein each virtual access point has a corresponding basic service set identifier (BasicServiceSetIdentifier, referred to as BSSID);

That is to say, multiple VAPs are established on the AP, and the multiple VAPs work on the same channel, have the same service set identifier (ServiceSetIdentifier, SSID for short), but have different BSSIDs. These VAPs will send out beacon frames with different BSSIDs. After the terminal receives the beacon frame, it can determine that it is sent by a different VAP according to the BSSID carried, so that the terminal can think that the beacon frame is sent by multiple APs.

Step 102, connect the terminal to a virtual access point according to the MAC address of the terminal, and authenticate the terminal;

In step 102, the following processes are required to connect the terminal to a virtual access point: 1. When the terminal needs to be connected to the virtual access point, judge whether there is a terminal with the same MAC address as the terminal according to the MAC address of the terminal Connect to the virtual access point; 2. When it is judged that no terminal with the same MAC address as the terminal is connected to the virtual access point, allow the terminal to connect to the virtual access point; 3. After judging that the virtual If the access point already has a terminal with the same MAC address as this terminal, it refuses to connect this terminal to this virtual access point, forcing this terminal to connect to other virtual access points (that is, other A virtual access point connected to a terminal with the same MAC address).

In a wireless network, the connection is easily disconnected, and the terminal connected first is not necessarily the legal terminal. Therefore, when a terminal wants to connect to a VAP, the AP needs to check whether there is already a terminal with the same MAC address connected to this VAP. The VAP of the SSID, thereby forcing the counterfeit terminal and the legitimate terminal to connect to different VAPs.

Step 103, for the legal terminal that has passed the authentication, bind the IP address and/or MAC address of the legal terminal with the BSSID of the virtual access point connected to the legal terminal, and determine the binding relationship between the legal terminal and the virtual access point;

It should be noted that the header of the 802.11 data frame sent by the terminal carries the BSSID. Since the legal terminal and the counterfeit terminal are connected to different VAPs, the BSSIDs contained in the frames sent by them are different, and the AP can distinguish which terminal sent the frame according to the BSSID.

Preferably, in practical applications, a terminal authorization status table can also be established, wherein the terminal authorization status table includes: IP address, MAC address, BSSID, and authorization status, and the authorization status includes: restricted, authorized, and prohibit.

In step 103, for the legal terminal that has passed the authentication, binding the IP address and/or MAC address of the legal terminal with the BSSID of the virtual access point connected to the legal terminal includes the following processing: 1. According to the terminal authorization status table, determine Whether there is an entry matching the MAC address and BSSID of the legal terminal, if so, modify the authorization status of the entry to authorized, and save the corresponding IP address; 2. According to the terminal authorization status table, determine whether there is a legal If there is an entry whose MAC address of the terminal matches but does not match the BSSID of the legal terminal, modify the authorization status of the entry to forbidden.

Step 104: forward the data frame sent by the legal terminal according to the binding relationship, and discard the data frame sent by the counterfeit terminal.

In step 104, forwarding the data frame sent by the legal terminal according to the binding relationship, and discarding the data frame sent by the fake terminal includes the following processing: 1. According to the terminal authorization status table, judge whether there is a MAC address and BSSID that match the legal terminal entry, if there is, then judge whether the source IP address in the message of the legal terminal matches the IP address in the entry; 2, if the IP address matches, then judge the authorization status in the entry; 3, judge whether the authorization status is If it is authorized, forward the message; when it is judged that the authorization state is prohibited, it discards the message; when it is judged that the authorization state is restricted, further judge whether the destination IP in the message is within the allowed address range; If the address is within the allowed address range, the packet will be forwarded; if it is not within the allowed address range, the packet will be discarded.

That is to say, after a legal terminal passes web authentication, the AP binds its IP/MAC address with the VAP it is connected to. In this way, the BSSID contained in the frame sent by the legitimate terminal is the same as the BSSID of the bound VAP, and is allowed to pass through; while the frame sent by the fake terminal, because the BSSID contained in it is inconsistent with the BSSID of the bound VAP, will be discarded by the AP. Thereby played a role in preventing counterfeit terminal.

In addition, when the terminal is disconnected, the following processing is also included: 1. According to the terminal authorization state table, check whether there is an entry with the MAC address and BSSID matching the terminal, and if there is an entry, check whether the authorization state of the entry is already Authorization; 2. If the authorization status of the entry is authorized, delay disconnection and set a predetermined time, if the authorization status of the entry is not authorized, disconnect immediately; 3. After the predetermined time expires, check Whether the terminal is still online, if online, keep the connection, otherwise, disconnect.

The technical solutions of the embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings.

Fig. 2 is a schematic diagram of the AP's process of preventing counterfeit users according to the embodiment of the present invention. As shown in Fig. 2, the wireless access module of the AP is used to implement functions such as establishing and disconnecting with the wireless terminal, and detecting whether the terminal is still connected ; The message forwarding module of the AP is used to forward the message received from the wireless network to the wired network, or conversely, to forward the message received from the wired network to the wireless network. The WebPortal authentication module of the AP is used to implement the Webportal authentication process.

The anti-counterfeiting module of the AP is used to realize the functions of distinguishing, judging, and blocking counterfeit terminals. According to the technical solution of the embodiment of the present invention, the newly added module in the AP, the anti-counterfeiting module is mainly used for: 1. When receiving the request for establishing a connection, check whether a terminal with the same MAC has been connected to the same VAP, if there is , then reject the connection; 2. When receiving a request to disconnect, check whether the terminal is online, in case the request comes from a fake terminal; 3. After the Webportal authentication is passed, establish the binding relationship between the IP address, MAC address and VAP . 4. When forwarding packets, judge whether to allow forwarding according to the binding relationship between IP+MAC and VAP.

In addition, the anti-counterfeiting module also maintains a terminal authorization state table, the entry format of which is: <IP address, MAC address, BSSID, authorization state>. Among them, there are three values of authorization state: restricted, authorized and prohibited. Restricted means that the terminal is only allowed to access the DHCP server, DNS server, Webportal server, etc.; Authorized means that the terminal is allowed to access the external network normally; Prohibited means that the packets of this terminal are prohibited from being forwarded.

It should be noted that in practical applications, the above functions of the anti-counterfeiting module are represented as a series of hook functions, including: authentication end hook function, WLAN-EAH forwarding hook function, ETH-WLAN forwarding hook function, connection establishment hook function, and connection Disconnect the hook function. The above-mentioned hook function is called by other modules when appropriate. Fig. 3 is the signaling flowchart of calling the hook function according to the embodiment of the present invention, as shown in Fig. 3, including the following processing:

Step 1, the terminal interacts with the AP, and the AP calls the connection establishment hook function to realize the 802.11 connection process;

In step 2, the terminal interacts with the DHCP server to dynamically obtain an IP address. From now on, when forwarding the message sent by the terminal and sent to the terminal, the AP will call the WLAN-EAH forwarding hook function and the ETH-WLAN forwarding hook function respectively;

Step 3, the terminal interacts with the Webportal server, and after the Webportal authentication is performed, the AP calls the authentication end hook function;

Step 4, after successful authentication, the terminal accesses the external network;

Step 5, the terminal interacts with the AP, and the AP invokes the connection disconnection hook function to realize the 802.11 disconnection process.

According to the 802.11 protocol, the process of establishing a wireless connection includes three steps: detection, authentication, and association. When receiving the authentication frame, the wireless access module will call the connection establishment hook function of the anti-counterfeit module, and the parameters passed are the MAC address of the terminal and the BSSID of the VAP connected to it. Fig. 4 is the call connection establishment of the embodiment of the present invention The flowchart of the hook function, as shown in Figure 4, includes the following processing:

Step 401, searching the terminal authorization state table to check whether there is an entry matching both the MAC address and the BSSID;

Step 402, if there is, then send an Authentication frame whose status code is 37 to the terminal, rejecting its authentication request;

Step 403, if not, add an entry in the terminal authorization state table, and set the initial authorization state as restricted, because the terminal has not obtained an IP address at this time, and set the initial IP address as 0.

As shown in Figure 3, when the terminal is disconnected, Disassociation or Deauthentication will be sent. At this time, the wireless access module will call the connection disconnection hook function of the anti-counterfeit module, and the parameters passed are the MAC address of the terminal and the BSSID of the VAP it is connected to. Fig. 5 is the flow chart of calling connection disconnection hook function of the embodiment of the present invention, as shown in Fig. 5, comprises following processing:

Step 501: Search the terminal authorization status table to check whether there is an entry matching the MAC address and the BSSID.

Step 502, if there is a matching entry, check whether its authorization status is authorized.

Step 503, if the authorization state of the matching entry is authorized, delay disconnection and start a timer; otherwise, disconnect immediately.

Step 504, after the timer expires, check whether the terminal is still online, if yes, keep the connection, otherwise, disconnect.

It should be noted that sometimes the counterfeit terminal will send a Deauthentication frame after receiving an Authentication frame rejecting the authentication request. If the AP receives it, treats it as a Deauthentication frame sent by a normal terminal, and disconnects immediately, it will affect the normal terminal. Therefore, it is necessary to delay the disconnection and check whether the terminal is really disconnected.

When the Webportal authentication ended, if the authentication passed, then call the authentication end hook function, the parameters passed are the IP address, MAC address, BSSID etc. of the terminal, Fig. 6 is the flow chart of calling the authentication end hook function of the embodiment of the present invention, as As shown in Figure 6, including the following processing:

Step 601, if the authentication fails, return directly;

Step 602, searching the terminal authorization status table to check whether there is an entry matching both the MAC address and the BSSID;

Step 603, if there is a matching entry, change the authorization status of the entry to authorized, and save the IP address;

Step 604, searching the terminal authorization status table to check whether there is an entry whose MAC address matches but BSSID does not match;

Step 605, if there is such an entry, it is considered as a counterfeit terminal, and the authorization status of the entry is changed to forbidden.

After the terminal is connected, when the message is forwarded, the forwarding hook function of the anti-counterfeit module will be called, and the parameters passed are the IP address, MAC address of the message and the VAP used to send and receive the message. Figure 7 is an embodiment of the present invention The flow chart of calling the forwarding hook function, as shown in Figure 7, includes the following processing:

Step 701, searching the terminal authorization state table to check whether there is an entry matching both the MAC address and the BSSID;

Step 702, if yes, compare the source IP address in the message with the IP address in the entry. If the IP addresses are equal, or the IP addresses in the entries are all 0, they are considered to match;

Step 703, if the IP address also matches, then check the authorization status. If it is authorized, forwarding is allowed; if it is prohibited, the message is discarded;

Step 704, if the status is restricted, it is also checked whether the destination IP is within the allowed address range. If not, discard the packet. Otherwise forwarding is allowed.

Because the BSSID is included in the 802.11 frame, but not in the Ethernet frame. In order to be able to distinguish which terminal the message is from on the wired side, methods such as mapping different BSSIDs to different VIDs, or converting MAC addresses and IP addresses can be adopted when forwarding messages.

It should be noted that, in the technical solution of the embodiment of the present invention, only one VAP can be established, and only the connection establishment and connection disconnection hook functions are reserved in the anti-counterfeiting module. The shortcoming of this simplified scheme is that it thinks that the terminal connected first is a legal terminal, and the terminal connected later is a fake terminal, but in fact the opposite situation may occur. It is recommended to adopt the above technical solutions.

Device embodiment

According to an embodiment of the present invention, an access point is provided. FIG. 8 is a schematic structural diagram of an access point according to an embodiment of the present invention. As shown in FIG. 8 , the access point according to an embodiment of the present invention includes: a first establishment module 80, a connection module 81, an authentication module 82, a second establishment module 83, and a processing module 84. It should be noted that the connection module 81 in the embodiment of the present invention is equivalent to the wireless access module in FIG. 2, and the authentication module 82 is equivalent to In the WebPortal authentication module in Fig. 2, some functions in the processing module 84 are equivalent to the message forwarding module in Fig. 2, and other functions in the first building module 80, the second building module 83, and the processing module 84 are equivalent to The anti-counterfeiting module in Figure 2. Each module of the embodiment of the present invention will be described in detail below.

The first establishing module 80 is configured to establish one or more virtual access points, wherein the virtual access points have a corresponding basic service set identifier BSSID;

That is to say, the first establishment module 80 establishes multiple VAPs on the AP, and the multiple VAPs work on the same channel, have the same service set identifier (ServiceSetIdentifier, SSID for short), but have different BSSIDs. These VAPs will send out beacon frames with different BSSIDs. After the terminal receives the beacon frame, it can determine that it is sent by a different VAP according to the BSSID carried, so that the terminal can think that the beacon frame is sent by multiple APs.

The connection module 81 is used to connect the terminal to a virtual access point according to the MAC address of the terminal;

Specifically, the connection module 81 includes:

The first judging submodule is used to judge whether a terminal with the same MAC address as the terminal is connected to the virtual access point according to the MAC address of the terminal when the terminal needs to be connected to the virtual access point; The input submodule is used to connect the terminal to the virtual access point when the first judging submodule judges that no terminal with the same MAC address as the terminal is connected to the virtual access point. When the first judging submodule judges that the virtual access point has a terminal with the same MAC address as the terminal, it refuses to connect the terminal to the virtual access point, and connects the terminal to other On the virtual access point of the terminal with the same MAC address of the terminal.

In a wireless network, the connection is easily disconnected, and the terminal connected first is not necessarily the legal terminal. Therefore, when a terminal wants to connect to a VAP, the AP needs to check whether there is already a terminal with the same MAC address connected to this VAP. The VAP of the SSID, thereby forcing the counterfeit terminal and the legitimate terminal to connect to different VAPs.

The authentication module 82 is used to authenticate the terminal;

The second establishment module 83 is used to bind the IP address and/or MAC address of the legal terminal to the BSSID of the virtual access point connected to the legal terminal for the legal terminal that has passed the authentication, and determine the connection between the legal terminal and the The binding relationship of the virtual access point;

It should be noted that the header of the 802.11 data frame sent by the terminal carries the BSSID. Since the legal terminal and the counterfeit terminal are connected to different VAPs, the BSSIDs contained in the frames sent by them are different, and the AP can distinguish which terminal sent the frame according to the BSSID.

Preferably, in practical applications, the access point according to the embodiment of the present invention further includes:

A state table establishment module, configured to establish a terminal authorization state table, wherein the terminal authorization state table includes: IP address, MAC address, BSSID, and authorization state, and the authorization state includes: restricted, authorized, and prohibition;

Specifically, the entry format in the terminal authorization status table is: <IP address, MAC address, BSSID, authorization status>. Among them, there are three values of authorization state: restricted, authorized and prohibited. Restricted means that the terminal is only allowed to access the DHCP server, DNS server, Webportal server, etc.; Authorized means that the terminal is allowed to access the external network normally; Prohibited means that the packets of this terminal are prohibited from being forwarded.

The second establishment module 83 is specifically used to: according to the terminal authorization state table, judge whether there is an entry matching the MAC address and the BSSID of the legal terminal, and if so, modify the authorization state of the entry to already authorize, and save the corresponding IP address; according to the terminal authorization state table, judge whether there is an entry matching with the MAC address of the legal terminal, and an entry that does not match the BSSID of the legal terminal, if there is, then the entry of the entry The authorization status is changed to prohibited;

The processing module 84 is configured to forward the data frames sent by the legitimate terminal according to the binding relationship, and discard the data frames sent by the counterfeit terminal.

The processing module 84 is specifically used for: judging whether there is an entry matching both the MAC address and the BSSID of the legal terminal according to the terminal authorization state table, and if so, judging the source IP address in the message of the legal terminal Whether it matches with the IP address in the entry; if the IP address matches, then judge the authorization status in the entry; when judging that the authorization status is authorized, then forward the message, and when judging that the authorization status is prohibited , then discard the message, and when it is judged that the authorization status is limited, further judge whether the destination IP in the message is within the allowed address range, and if it is within the allowed address range, then forward the message If the address is not within the allowed address range, the message is discarded.

That is to say, after the legal terminal passes the Web authentication, the processing module 84 binds its IP/MAC address with the VAP it is connected to. In this way, the BSSID contained in the frame sent by the legitimate terminal is the same as the BSSID of the bound VAP, and is allowed to pass through; while the frame sent by the fake terminal, because the BSSID contained in it is inconsistent with the BSSID of the bound VAP, will be discarded by the AP. Thereby played a role in preventing counterfeit terminal.

In addition, the technical solution of the embodiment of the present invention may further include: a disconnection processing module, configured to check whether there is a MAC address and The entry of BSSID exists, if the entry exists, check whether the authorization status of the entry is authorized; if the authorization status of the entry is authorized, then delay disconnection, and set a predetermined time, if the If the authorization status of the entry is not authorized, then disconnect immediately; after the predetermined time expires, check whether the terminal is still online, if online, keep the connection, otherwise, disconnect.

It should be noted that, in practical applications, other functions in the first building module 80, the second building module 83, and the processing module 84 are represented as a series of hook functions, including: authentication end hook function, WLAN-EAH forwarding hook function , ETH-WLAN forwarding hook function, connection establishment hook function, and connection disconnection hook function. The above-mentioned hook function is called by other modules when appropriate. The specific invocation timing and invocation processing flow can be understood with reference to FIG. 3 to FIG. 7 of the above method embodiment, and will not be repeated here.

It should be noted that the BSSID is only included in the 802.11 frame, but not in the Ethernet frame. In order to be able to distinguish which terminal the message is from on the wired side, methods such as mapping different BSSIDs to different VIDs, or converting MAC addresses and IP addresses can be adopted when forwarding messages.

In the technical solution of the embodiment of the present invention, only one VAP can be established, and only the connection establishment and connection disconnection hook functions are reserved in the anti-counterfeiting module. The shortcoming of this simplified scheme is that it thinks that the terminal connected first is a legal terminal, and the terminal connected later is a fake terminal, but in fact the opposite situation may occur. It is recommended to adopt the above technical solutions.

The embodiment of the present invention establishes a VAP and binds the IP+MAC of the legal terminal to the VAP, which solves the problem in the prior art that it is impossible to prevent counterfeit users when the messages transmitted over the air in the wireless access network are not encrypted, and can realize In the 802.11 wireless access network, the purpose of preventing counterfeit users is to protect the interests of legitimate users and operators.

Although preferred embodiments of the present invention have been disclosed for illustrative purposes, those skilled in the art will appreciate that various modifications, additions and substitutions are possible, and therefore, the scope of the present invention should not be limited to the above-described embodiments.

Claims (8)

1. prevent a method for fake user in wireless access network, it is characterized in that, comprising:

Set up one or more virtual access point, wherein, described virtual access point has basic service set identification BSSID corresponding thereto;

Described terminal is connected to a virtual access point by the MAC Address according to terminal, and carries out certification to described terminal;

For the legal terminal by certification, the BSSID of the virtual access point MAC Address of described legal terminal be connected with described legal terminal binds, and determines the binding relationship of described legal terminal and described virtual access point;

Forward the Frame of described legal terminal transmission according to described binding relationship, abandon the Frame that personation terminal sends;

Wherein, described terminal is connected to a virtual access point and comprises by the described MAC Address according to terminal:

When described terminal needs to be connected to virtual access point, judge whether that the terminal identical with the MAC Address of described terminal is connected to this virtual access point according to the MAC Address of described terminal;

When judging that the terminal identical with the MAC Address of described terminal is not connected to this virtual access point, described terminal is connected to this virtual access point;

When judging that this virtual access point exists the terminal identical with the MAC Address of described terminal, described terminal is connected to this virtual access point by refusal, and described terminal is connected on other virtual access point that terminal identical with the MAC Address of described terminal does not connect.

2. the method for claim 1, is characterized in that, described method also comprises:

Set up an authorization terminal state table, wherein, described authorization terminal state table comprises: IP address, MAC Address, BSSID and licensing status, and described licensing status comprises: limited, authorize and forbid.

3. method as claimed in claim 2, it is characterized in that, when described terminal disconnects, described method also comprises:

According to described authorization terminal state table, check whether that the entry of MAC Address and the BSSID mated with described terminal exists, if there is described entry, then check whether the licensing status of described entry is authorize;

If the licensing status of described entry is for authorize, then postpones to disconnect, and a scheduled time is set, if the licensing status of described entry is not authorized, then disconnect immediately;

The described scheduled time then after, check that described terminal is whether still online, if online, then keep connecting, otherwise, disconnect.

4. method as claimed in claim 2, it is characterized in that, described for the legal terminal by certification, the BSSID of the virtual access point described legal terminal MAC Address be connected with described legal terminal carries out binding and comprises:

According to described authorization terminal state table, judge whether and the entry that the MAC Address of described legal terminal and BSSID are all mated, if had, then the licensing status of this entry is revised as and authorizes, and preserve corresponding IP address;

According to described authorization terminal state table, judge whether to mate with the MAC Address of described legal terminal, entry unmatched with the BSSID of described legal terminal, if had, then the licensing status of this entry is revised as and forbids.

5. method as claimed in claim 2, is characterized in that, the described Frame forwarding the transmission of described legal terminal according to described binding relationship, and the Frame abandoning the transmission of personation terminal comprises:

According to described authorization terminal state table, judge whether and the entry that the MAC Address of described legal terminal is all mated with BSSID, if had, then judge whether the source IP address in the message of described legal terminal mates with the IP address in this entry;

If IP matching addresses, then judge the licensing status in this entry;

When judging described licensing status as authorizing, then forward described message, when judging described licensing status as forbidding, then abandon described message, judging that described licensing status is as by limited time, judge object IP in described message further whether in the address realm of permission, if in the address realm allowed, then forward described message, if not in the address realm allowed, then abandon described message.

6. an access point, is characterized in that, comprising:

First sets up module, and for setting up one or more virtual access point, wherein, described virtual access point has basic service set identification BSSID corresponding thereto;

Link block, is connected to a virtual access point for the MAC Address according to terminal by described terminal;

Authentication module, for carrying out certification to described terminal;

Second sets up module, and for for the legal terminal by certification, the BSSID of the virtual access point MAC Address of described legal terminal be connected with described legal terminal binds, and determines the binding relationship of described legal terminal and described virtual access point;

Processing module, for forwarding the Frame that described legal terminal sends according to described binding relationship, abandons the Frame that personation terminal sends;

Wherein, described link block specifically comprises:

First judges submodule, for when described terminal needs to be connected to virtual access point, judges whether that the terminal identical with the MAC Address of described terminal is connected to this virtual access point according to the MAC Address of described terminal;

Access submodule, for when described first judges that submodule judges that the terminal identical with the MAC Address of described terminal is not connected to this virtual access point, described terminal is connected to this virtual access point when described first judges that submodule judges that this virtual access point exists the terminal identical with the MAC Address of described terminal, described terminal is connected to this virtual access point by refusal, and described terminal is connected on other virtual access point that terminal identical with the MAC Address of described terminal does not connect.

7. access point as claimed in claim 6, it is characterized in that, described access point also comprises:

Module set up by state table, and for setting up an authorization terminal state table, wherein, described authorization terminal state table comprises: IP address, MAC Address, BSSID and licensing status, and described licensing status comprises: limited, authorize and forbid;

Disconnect processing module, for when described terminal disconnects, according to described authorization terminal state table, check whether that the entry of MAC Address and the BSSID mated with described terminal exists, if there is described entry, then check whether the licensing status of described entry is authorize; If the licensing status of described entry is for authorize, then postpones to disconnect, and a scheduled time is set, if the licensing status of described entry is not authorized, then disconnect immediately; The described scheduled time then after, check that described terminal is whether still online, if online, then keep connecting, otherwise, disconnect.

8. access point as claimed in claim 7, is characterized in that,

Described second set up module specifically for: according to described authorization terminal state table, judge whether and the entry that the MAC Address of described legal terminal and BSSID are all mated, if had, then the licensing status of this entry is revised as and authorizes, and preserve corresponding IP address; According to described authorization terminal state table, judge whether to mate with the MAC Address of described legal terminal, entry unmatched with the BSSID of described legal terminal, if had, then the licensing status of this entry is revised as and forbids;

Described processing module specifically for: according to described authorization terminal state table, judge whether and the entry that the MAC Address of described legal terminal is all mated with BSSID, if had, then judge whether the source IP address in the message of described legal terminal mates with the IP address in this entry; If IP matching addresses, then judge the licensing status in this entry; When judging described licensing status as authorizing, then forward described message, when judging described licensing status as forbidding, then abandon described message, judging that described licensing status is as by limited time, judge object IP in described message further whether in the address realm of permission, if in the address realm allowed, then forward described message, if not in the address realm allowed, then abandon described message.